🔖 Release / v1.1.1

[docJerem]

Summary

Patch release bundling the three commits merged since v1.1.0 (2026-05-06).

Fixed

• IdP-initiated SSO flow no longer rejects all valid Responses with :access_denied — validate_authresp/4 now returns {:ok, flow, nonce} and consume_signin_response/2 exposes a flow: field in its success map (🐛 Fix / IdP-initiated flow never completes — validate_authresp returns bare :ok #27, closes 🐛 IdP-initiated success branch in SPHandler.validate_authresp returns :ok — caller expects {:ok, nonce} → unreachable #24)
• ExSaml.SPHandler.send_saml_response/3 no longer crashes on nil target URL in the SAML error path — renders an HTML 403 instead of attempting a redirect (🐛 Fix / Prevent nil target URL crashing redirect in SAML error path #26)

Changed

• consume_signin_response/2 success map gains an additive flow: field (:sp_initiated or :idp_initiated) (🐛 Fix / IdP-initiated flow never completes — validate_authresp returns bare :ok #27)
• Error atom :idp_first_flow_not_allowed → :idp_initiated_not_allowed for alignment with standard SAML terminology. Unobservable in practice — the IdP-initiated flow itself was broken before 🐛 Fix / IdP-initiated flow never completes — validate_authresp returns bare :ok #27 (🐛 Fix / IdP-initiated flow never completes — validate_authresp returns bare :ok #27)
• Internal stale_time/1 rewritten in idiomatic Elixir, drops two dialyzer suppressions, adds dedicated unit tests (♻️ Refactor / Rewrite stale_time/1 in idiomatic Elixir (#14) #28, ♻️ Refactor / Clean up upstream esaml code style #14)

Test plan

• mix test green
• mix dialyzer clean
• mix credo --strict clean
• CHANGELOG and @version in mix.exs agree on 1.1.1
• After merge: tag v1.1.1 on main and mix hex.publish